fix: retain temporary Cargo data without producer evidence

[seonghobae]

A matching temporary folder name and an empty Cargo lock file previously admitted arbitrary contents to a cleanup plan. A synthetic folder containing a sole source copy and Claude session reproduced an approval-ready plan with no blockers. The producer test creates a predictable target path but records no source binding or ownership receipt.

Current head 2069d649dbbb9222d49fc0fcaac2965653478f72 rejects this temporary-Cargo candidate before reading its contents for a fingerprint. Existing candidate/wire recognition is retained, but it grants no actionable cleanup plan. Re-enabling requires producer-bound retained-source and target identity evidence, correct native Cargo target/build-directory confinement, and the shared session/concurrency prerequisites. Folder names and empty lock files are insufficient.

Validation: the new regression fails against the prior implementation by receiving an unblocked plan; after repair, 19 actual-module/integration tests and 3 CLI tests pass on macOS. The source and session sentinels remain intact. This is controlled-boundary regression evidence, not universal false-positive or physical-capacity proof. No user data was deleted. The PR remains Draft; protected checks, independent review, and prerequisite integration are outstanding.

The normal parent merge includes PR322 fa1e8db4abcba6d76463f7611b52062e3fbb7dcf and preserves parent identity, original-command association, self-PID filtering, and symlink-manifest behavior. The unsafe former ownership assertion is superseded by this explicit producer-evidence gate.

Prior proposal and preserved context

The earlier proposal below records historical intent and evidence. Any assertion that matching temporary Cargo names are already safe to reclaim is superseded by the current behavior above.

Outcome

• admits only DiskSage-owned Cargo target roots directly under the macOS per-user temporary directory with a regular Cargo lock marker
• preserves neighboring temp data and all provider, Photos, VM, Git, lock, and active-process boundaries
• removes direct invoking-shell command-line noise while retaining lsof descriptor evidence
• records exact plans, fresh approvals, atomic staging, and immutable terminal receipts

Live evidence

• removed two inactive DiskSage Cargo targets with exact receipt allocations of 2,845,298,688 and 4,989,251,584 bytes
• both receipts report removed=true and provider_data_mutated=false
• observed APFS available delta across the two executions: +7,161,544 KiB (concurrent APFS activity applies)

Validation

• cargo test --manifest-path src-tauri/Cargo.toml generated_cache_reclaim::tests::disksage_owned_temporary_cargo_target_is_regenerable_but_neighbors_are_not --lib (1 passed)
• product CLI build passed and both live plan/execute flows completed
• git diff --check

---

Protected prerequisite status

This PR remains Draft while the generated-cache owner PR #295 and its protected safety prerequisites remain Proposed and unmerged. Parent-handle checks reduce a reproduced gap; they do not prove exclusion of arbitrary late writers. Atomic no-replace restoration and current-head validation remain acceptance work. Unique changes are preserved through normal non-force parent integration; this status change is not a close or a shipped-safety claim.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}